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' Abstract 
^1" ' 

C*~) ■ We give a quantum algorithm for solving a shifted multiplicative character problem 

over Z/nZ and finite fields. We show that the algorithm can be interpreted as a matrix 
factorization or as solving a deconvolution problem and give sufficient conditions for a 
CS ■ shift problem to be solved efficiently by our algorithm. We also show that combining 

the shift problem with the hidden subgroup problem results in a hidden coset problem. 



' This naturally captures the redundancy in the shift due to the periodic structure of 



multiplicative characters over Z/nZ. 



^ 1 Introduction 

FT 

The Fourier transform lies at the heart of the solution of all problems that are known to admit 
a large quantum speedup over classical algorithms. This is due to two factors, the quantum 
Fourier transform can be performed exponentially faster than its classical counterpart, and 
the Fourier transform is particularly suited to extracting information about periodicities. 

Taking a periodic superposition, performing a Fourier transform and measuring gives us 
the period. More generally, the Fourier transform of a superposition over coset states of a 
subgroup yields a superposition over the dual or "perp" of the subgroup. This is the basis 
of the hidden subgroup problem. The most well known example of a problem and algorithm 
fitting this framework is Shor's solution to the factoring problem 0. 
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However, information about periodicities is not the only feature that Fourier transforms 
can identify. The Fourier transform can also identify shifts or translations. This suggests 
that we look for ways in which the Fourier transform can be used to identify unknown shifts. 

The shift problem may be formulated as follows. 

Let g be a complex valued function defined on the group G. Let / be a shifted version 
of g where f(x) = g(x + s) for some s in G. Find s. 

We give an efficient quantum algorithm for solving the shift problem provided G is abelian 
and g satisfies certain conditions. The conditions are satisfied if G is the additive group 
of a finite field and g is a multiplicative character. So our algorithm solves the shifted 
multiplicative character problem on a finite field. 

If the shift is not uniquely determined, it can be shown that the set of possible shifts is 
a coset of a subgroup of the group G. We then have the hidden coset problem. 

Let g be a complex valued function defined on the group G. Let / be a shifted version 
of g where f(x) = g(x + s) for some s in G. Find all s' satisfying f(x) = g(x + s') for all x. 

The hidden coset problem combines the features of the hidden subgroup problem and 
the shift problem. Our algorithm treats this problem by first solving a hidden subgroup 
problem to find H and then solving a shift problem on the quotient group G/H. The 
shifted multiplicative character problem over Z/nZ fits this framework. The multiplicative 
characters of Z/raZ are periodic with respect to the additive group and so the shift is not 
uniquely determined. 

Our algorithm solves the shifted Legendre symbol problem and the shifted quadratic 
character problem considered by van Dam and Hallgren ||. The quadratic character is an 
example of a multiplicative character and the Legendre symbol is the quadratic character for 
Z/pZ. van Dam and Hallgren also give an algorithm for the shifted Jacobi symbol problem 
for Z/nZ where n is square free. The Jacobi symbol is also an example of a multiplicative 
character. Our treatment solves the problem for all multiplicative characters of Z/raZ for all 
odd n. 

2 The Shift Problem 

In this section we state the shift problem, and show how it can be formulated in terms of 
matrix multiplication. By factoring the relevant matrix we obtain an algorithm for solving 
the shift problem and also sufficient conditions for the algorithm to be implemented efficiently 
on a quantum computer. The analysis involves Fourier transforms over finite abelian groups. 
For a review of characters and Fourier transforms over finite abelian groups see Appendix [A[ 

The shift problem is the following. Let g be a complex valued function defined on the 
group G. Let / be a shifted version of g where f(x) = g(x + s) for some s in G. Find s. 

We begin by reformulating the shift problem in the following way. Let s be the unknown 
shift and X be the matrix with columns and rows indexed by the elements of G and the 
matrix element in row x and column y given by g(x+y). The precise ordering of the elements 
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of G is irrelevant as long as we are consistent. That is 



X=[g(x + y)l 



x,y£G 



We then compute 



x \ s ) = + s)\x) 

x&G 



xeG 

Solving the shift problem then reduces to inverting X. 

We show below that the structure of X allows us to factor X into X = (F T )~ 1 DF~ 1 , 
where F is the Fourier transform matrix and D is a diagonal matrix. The diagonal entries of 
D (up to a scale factor) turn out to be the Fourier transform of g evaluated at the characters 
of G. Provided g satisfies certain conditions, we can efficiently compute X -1 by inverting 
F T , D and F in turn to obtain X" 1 = FD^F 7 . 



2.1 Matrix Factorization 

We now show that X is "diagonalized"Q by the Fourier transform matrix. Let F be the 
Fourier transform matrix defined by 



y&G 



where x and y index the rows and columns respectively and ip y is a character of G indexed 
by y. Thus each column of F contains a character of G evaluated at all elements of G. 
Computing F T XF we find that 



F T XF=[i, v {x)}\g{x + y)}U w {y)] 



y,w 



^g(x + y)tfj w (y) 



,yeG 



yeG 



^w{x)^g(y)^u,(y) 

yeG 



Strictly speaking we are not diagonalizing X as that would mean writing X = FDF^ and not X 
FDF T . 
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- 1 v.w 



_xeG 

= [\G\g(ip w )5 vw ) v>w , 

which is a diagonal matrix. Let D denote this diagonal matrix and we have F T XF = D. 

2.2 Matrix Inversion 

The algorithm then consists of computing X~ l = FD~ 1 F T . If X is not full rank, then D 
contains some zeros along the diagonal. We then calculate the pseudoinverse of X (sometimes 
called the Moore-Penrose generalized inverse). The pseudoinverse of X, X* satisfies 

• XX*X = X, 

• X*XX* = X, 

• XX* and X*X are Hermitian. 

The pseudoinverse of a matrix always exists and is unique [[|. The pseudoinverse of a 
diagonal matrix is given by inverting the nonzero elements of the diagonal. We then have 
X* = FD*F T . 

The fraction of zeros along the diagonal of D gives the probability of error, the probability 
that the algorithm fails to output s. 

2.3 Sufficient Conditions 

To implement the algorithm efficiently we need some conditions on g. 

1. The magnitude of g(x) is constant for all x such that g(x) is nonzero. 

2. The Fourier transform of g, g{ip y ), has constant magnitude for all y for which g(ip y ) is 
nonzero. 

3. g can be computed efficiently up to a multiplicative constant (on a classical computer). 

The above conditions are sufficient for efficient implementation of the algorithm. The fol- 
lowing two parameters determine the probability of the algorithm outputting the correct 
answer. 

1. a, the fraction of x in G for which g(x) is nonzero 

2. f3, the fraction of y in G for which the Fourier transform of g, g(ip y ), is nonzero. 
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The probability of our algorithm succeeding is a(3. 

Condition [l| is needed to be able to create the superposition with \x) having amplitude 
g(x) up to a global constant, 

^2g(x)\x). 

x&G 

This can be done efficiently with probability a. 

Conditions ^| and |3| are needed because we will need to compute g(ip y ) to invert D. 

The parameter (3 is describes the rank of D and thus of X. When we apply X followed 
by its pseudoinverse, we get a vector close enough to \s) so that when we measure we obtain 
s with probability (3. 

Thus the overall probability of success of the algorithm is af3. 

2.4 Implementation of the Algorithm 

We now show how to implement the algorithm efficiently on a quantum computer. 

1. Setup a superposition of the all the values of / with the amplitude of \x) equal to f(x) 
to obtain 

Cj29(x + s)\x). 

2. Compute the Fourier transform to obtain 

ydG 



3. Now compute g(ip y ) into the phase to obtain 

C" £ Us)\y) 

yeG 

4. Computing the inverse Fourier transform and measuring gives —s. 
In step m we setup a superposition over the elements of G, 

compute f{x) and measure to see whether f{x) is zero. If so, then the algorithm fails. If 
not, we are left with a superposition over all x such that f(x) ^ 0. The algorithm succeeds 
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here with probability a. We next compute f(x) into the amplitude of \x) (up to a constant 
factor) . Condition [I] ensures that we can do this by computing the phase of f(x) into the 
phase of \x). We can always approximate this arbitrarily closely by approximating the phase 
of f(x) to the nearest 2 n th root of unity for some sufficiently large n. 
Step |2| follows from observing that 

c ' E ( E fa + s)M*)) \v) = c E - A \y) 

y£G \x<=G J y£G \zeG J 

= c'YM°) (E^M/(z)J \v) 

y&G \xeG J 

y eG 

where C is a constant. 

Step |3| can be performed because of Conditions |2] and ^. 

In Step I] we measure and obtain — s with probability of f3. The reason we get — s instead 
of s is that computing the inverse Fourier transform corresponds to multiplying by instead 
of F T . 

Thus the algorithm succeeds in identifying s with probability a(3 and only requires one 
query of / and one query of g . 



3 The Hidden Coset Problem 

If g has a "subgroup" structure then the shift may not be unique. We can make this precise 
in the following way by formulating a hidden coset problem that combines the features of 
the shift problem with that of the hidden subgroup problem. The hidden coset problem is a 
shift problem where the shift may not be uniquely defined. 

The hidden coset problem is the following. Let g be a complex valued function defined 
on the group G. Let / be a shifted version of g where f(x) = g(x + s) for some s in G. Find 
all s' satisfying f(x) = g(x + s') for all x. 

Let H be the largest subgroup of G such that g is constant on cosets of H. Because of the 
structure of g, s is determined only "modulo" H. Thus to solve the hidden coset problem, 
we need to first identify the hidden subgroup H and then the shift s modulo H. 

Assuming that we have already found H, to find s modulo H, define g' and /' as complex 
valued functions on the quotient group G/H in the natural way so that g'(x + H) = g{x) 
and f'(x + H) = f(x) for all x in G. Then if g' satisfies the conditions in Section |2.3| when 
considered over the group G/H we can apply the algorithm for the shift problem to find s 
modulo H. 
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We now show how to find H. The standard formulation of the hidden subgroup problem 
assumes that g is constant on cosets of H and that g takes on distinct values on distinct 
cosets. This can be solved using the "standard" algorithm 

1. Prepare a superposition over all of G. 

2. Computing g into a register. 

3. Fourier sampling to obtain a random element of H . 

The condition that g takes on distinct values on distinct cosets of H means that we 
sample uniformly over the elements of H^. This condition can be relaxed slightly so that 
the standard algorithm still works. Boneh and Lipton Q and Mosca and Ekert || give the 
condition that g' is at most m to 1 and m is less than the smallest prime factor of \H\, the 
cardinality of H. Hales and Hallgren || give the condition that at least a polylogarithmic 
number of values of g need to be changed to reduce the period of g. 

However, as we already have restrictions on g' and g' (so that we can solve the shift prob- 
lem) we can give another condition for the hidden subgroup problem to be solved efficiently 
If /3, the fraction of values of g' that is nonzero satisfies (3 > 1/p + poly log(|iif|), where p is 
the smallest prime factor of \H\, then the following algorithm will find H. 

1. Prepare a superposition over all of G. 

2. Computing g into the phase. 

3. Fourier sampling to obtain a random element of H^-. 

The difference from the standard algorithm for solving the hidden subgroup problem is that 
we compute g into the phase. 

4 Shifted Character Problem (Finite Field) 

The shifted character problem for the finite field ¥ q is as follows. 

Given a finite field ¥ q (where q = p m for some prime p), a multiplicative character \ °f 
F q and a shifted version of %■> f( x ) — x{ x + s )- Find s. 

For a review of additive and multiplicative characters in finite fields see Appendix [AJ Ap- 
pendix |B| contains a discussion of Fourier transforms over the additive group of multiplicative 
characters. 

The shifted multiplicative character problem over a finite field fits into our general frame- 
work. The group G is the additive group of the finite field, g = x is a (non-trivial) multi- 
plicative character of ¥ q . We show that x satisfies the sufficient conditions of Section |2.3| . 

1. For all nonzero x, x( x ) nas unit magnitude. 
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2. x(ipo) = and as shown in Appendix [B], x(^/V0 = xiQ^xi^g ) an d so nas magnitude 
IxCV's ) I which is constant. 

3. x an d thus x(.9 m ) can be computed efficiently. So x can be computed efficiently (up 
to a constant phase). 

We next calculate the probability of our algorithm succeeding. 

1. x( x ) i s zero only if a: = so a = 1 — 1/q. 

2. x(if> y ) is zero if for y = so /3 = 1 — 1/q. 

So our algorithm succeeds with probability a(3 = (1 — 1/q) 2 - 

5 Shifted Character Problem for Z/nZ 

The shifted character problem for Z/nZ is as follows. 

Given a ring Z/nZ with n odd, a multiplicative character x of Z/nZ and a shifted version 
of x, f(x) = x( x + s )- Find s. 

The shifted character problem over Z/nZ has the interesting feature that the solution to 
the shift is not unique. This is because multiplicative characters in Z/nZ have periodicities 
with respect to the additive group. See Appendix [A] for a discussion of periodicities of multi- 
plicative characters. Appendix [B] contains a discussion of Fourier transforms of multiplicative 
characters. 

The shifted character problem over Z/nZ fits into the hidden coset problem framework 
described in Section |3] so we can apply our algorithm. If n = p™ 1 . . . p// k we have a — (3 — (1 — 
1/pi) . . . (1— 1/pk) and so our algorithm will succeed with probability (1— l/pi) 2 ...(l — 1/pk) 2 
(after solving the associated hidden subgroup problem). 

6 Interpretation as Deconvolution 

Our algorithm for solving the shift problem can be thought of solving a deconvolution prob- 
lem. To see this, let S y (x) = 8(x — y) be the delta function centered at y. Then / is the 
convolution of <5_ s and g, that is 

/ = 5- s -kg. 

So to recover s or equivalently 5- s , we need to solve a deconvolution problem. 

Taking Fourier transforms and observing that in the Fourier domain convolution becomes 
pointwise multiplication we see that 

/ = 8-s ■ 9, 
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where /, g, 5- s are the Fourier transforms of /, g and 5- s respectively. We then have 

S- s = T~ x (f/g) 

where the division is pointwise. 

For the division to be performed on efficiently on a quantum computer would require 
that the magnitude of g be constant and non-zero. However even if a fraction of the values 
of g are zero we can still approximate division of g by only dividing when g is non-zero and 
doing nothing otherwise. 

Deconvolution is a well studied classical problem and perhaps this interpretation will 
enable us to leverage existing deconvolution techniques to broaden the class of problems 
amenable to our approach. 

7 Conclusion 

We have presented a general framework for a class of shift problems and a set of sufficient 
conditions for the problems to be efficiently solved on a quantum computer. However, the 
sufficient conditions are fairly restrictive although they include the shifted multiplicative 
character problem over finite fields and rings Z/nZ. 

It would be of interest to investigate what other shift problems satisfy the sufficient 
conditions and whether a less restrictive set of sufficient conditions exists. 
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A Mathematical Background 

We start with some definitions and background. For more details see the book by Lidl and 
Niederreiter M, and the book by Tolimieri et al. p|. 

A.l Characters of a Group 

A character x of a finite abelian group G is a homomorphism from a group G to (C, x), the 
group of complex numbers with multiplication. That is 

X{gi92) = x(9i)x(92) 
for all gi,g2 € G. If G is cyclic with generator g, the characters are 

Xk (g l )=exp(2mkl/\G\) 

for k = 0, . . . , \G\ - 1. 

The characters of G form a group G, known as the dual group, with multiplication defined 

as 

(xiX2)(sO = xi(g)x2(g) 

for all xi, X2 £ G, g G G. G is isomorphic to G. In particular, \G\ = \G\, that is the number 
of characters of G is the same as the cardinality of G. 
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A. 2 Fourier Transform over a Group 

Given a complex valued function / over G, the Fourier transform of / over the group G is 
given by 

g&G 

for all x ^ G. 

A. 3 Characters of a Field 

In a field ¥ q (where q = p m for some prime p) we have two operations, multiplication and 
addition, with corresponding groups. Thus we can define two different groups of characters. 

Characters of the multiplicative group F* of ¥ q are called multiplicative characters of ¥ q . 
Since F* is cyclic with order q — 1, its characters xo, ■ ■ ■ Xq-2 can be explicitly represented as 

, / 2irikl\ 

Xk{g ) = exp I — - - 1 

for all I = 0, 1, . . . , q — 2, where g is a generator of F*. It is often convenient to extend the 
definition of Xk to include by defining Xfc(0) = 0. The quadratic character referred to in 
van Dam and Hallgren || is x g-\ . 

Characters of the additive group of ¥ q are called additive characters of ¥ q . The additive 
characters ip a (for all a G ¥ q ) have the form 

for all c G ¥ q , where 

171 — 1 

Tr(x) = 

k=0 

is the trace function from F g to ¥ p and F p is identified with Z/pZ for the purposes of 
evaluating the exponential. ip\ is the canonical additive character of ¥ q . We have that 
ip a (c) = ipi(ac). 

A A Characters of Z/nZ 

Similarly we can define additive and multiplicative characters in Z/p m Z where p is an 
oddF] prime. Z/p m Z with addition is a cyclic group so we can define additive characters 

2 We only consider odd p because (Z/2 m Z)* is not cyclic for m > 3. In fact, (Z/2 m Z)* is the product of 
two cyclic groups 0. 
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■00, • • • ,VV m -l 

/ 2irikx\ 
w) = exp j 

for all x e Z/p m Z. 

(Z/p m Z)* is a cyclic group, so we can define multiplicative characters Xo? • ■ • , X(p-i)p m - 1 -ii 
where 

for all I — 0, 1, . . . , (p — l)p m_1 — 1 and g is a generator of (Z/p m Z)*. We can extend the 
definition of Xk to include all of Z/p m Z by defining Xk{x) — if x is a multiple of p. 

Z/nZ with addition is a cyclic group so we can define additive characters ipo, . . . , ipn-i 

( 2nikx\ 
ip k (x) = exp I — - — 1 

for all x e Z/nZ. 

If n is odd, we can define multiplicative characters over Z/nZ by observing that if n = 
pf 1 ...p™ k then 

Z/nZ = Z/p^Z © ■ ■ ■ © Z/p™ k Z. 

Let be an isomorphism from Z/nZ to Z/p^Z©- • -©Z/p™ fc Z with 0(x) = . . . , 4>k(x)) 

given by 0j(x) = i mod p™ 3 . Define the multiplicative characters as the product of the 
multiplicative characters in the corresponding Z/pJ^Z. That is 

k 

Xh,-,lk( X ) = nx£\<f>r( x )), 

r=l 

where Xi is a multiplicative character of Z/p™ r Z. Noting that all the Xh,...,h are distinct 
for appropriate ranges of l±, . . . , and that there are exactly the right number of them we 
see that we have all the multiplicative characters. 

A. 5 Periodicities of Multiplicative Characters of Z/p m Z 

The multiplicative characters of Z/p m Z have a particular additive periodic structure. Every 
multiplicative character has a period that is a power of p. That is, for every k, there is a j 
such that 

Xk(x+p>) = Xk(x) 

for all x G Z/p m Z. 

In fact we have the following theorem M that explicitly gives the period. 
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Theorem 1 Let g be a generator of the group of units (Z/p m Z)* and let Xk be a multiplicative 
character of r Ljp mr L defined 



if V\ x i 

exp ( (p-ff-i ) ifx = 9 l - 



Let j be such that gcd(p m , k) = p m K Then pi is the additive period of Xk, the smallest T 
such that Xk{x + T) = Xk( x ) f or a ^ x £ Z/p m Z. 

Proof: Suppose gcd(p m , k) = p m ~i and that the period of Xk is T. We first show that T\pP 
and then that T = p 3 . 

If p\x then p\{x + p 7 ) and so Xk( x + P*) = = If £ = <?' then because p m ~^\k, the 

value of Xk{g l ) is determined by the value of / mod (p — l)^ -1 , which is in turn determined 
by the value of g l mod pP . But g l + pP ' = g l mod pP and so + pP) = Xk{x). This shows 
that T\p>. 

Since T|p J , if T 7^ p> , we must have T = pP for some j' < j. Then Xfc(l) — Xfc(l + ^P 7 ) 
for all r = 0, . . . , p m ~i' — 1. Now 

{1 + rpP' : r = 0, . . . ,p m ^'' - 1} = {gtP-W'' 11 ' : /' = 0, . . . ,p m " J " - 1} 

since all the g^ p ^ pJ ll ' are distinct and g^ 1 ^ ll ' = 1 mod pi' . But Xkig^" 1 ^ = 1 
for all I' only if — l)pp ~ l is a multiple of (p — l)p m ~ l which implies that p m ~i \k. This 
is a contradiction since p m_J was the largest power of p dividing k. Thus T = pP . □ 

A. 6 Periodicities of Multiplicative Characters of l^jnL 

As we saw in Appendix [A.4| , a multiplicative character Xh,...,i k °f Z/nZ can be decomposed 
into a product of multiplicative characters x^ ■ • ■ x| : °f Z/p^Z, . . . , Z/p™ fe Z. The period 
of Xii,...,ife i s th en the product of the periods of x^ • • • Xj • 

B Fourier Transforms of Multiplicative Characters 

B. l Finite Field Case 

Consider the natural representation of F*, the multiplicative group. It is well known that this 
is cyclic. If g is a generator then the elements can be represented as {1, g, g 2 , g 3 , ■ ■ ■ , g q ~ 2 }- 
The multiplicative characters are then exponentials in k 



xi(g k ) 



exp 



2nikl 
~q~l 
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The non-trivial additive characters can be written 



Vy4# ) = exp I I . 

Note that these are all translates of the canonical additive character 

. , fcA {2mTr(g k )\ 
ij g o(g k )=exp ( J^J ■ 

When we take the Fourier transform of a multiplicative character over the additive group 
we are expressing an exponential in terms of a basis where the basis functions are translates 
of the canonical additive character. To compute the change of basis we compute the inner 
product of the exponential with all the translates of the canonical additive character. This 
is the same as the inner product of the canonical additive characters with the exponential 
translated in the opposite direction. But a translated exponential is just the original ex- 
ponential with a phase shift that is given by the exponential of the size of the translation. 
Thus 

q-2 
k=0 

^ /2mTr (g m g k )\ f2nikl\ 

= S exp v — p — r xp U^J 

/ 2iriml\ 
= exp I - ^_ - I XlKW 

= Xi(g m )Xi(*P g °)- 



B.2 Z/p m Z Case 

If a multiplicative character xi of Z/p m Z has no periodicity, then p \ I. An extension of the 
argument used for the finite field case shows that 



Xii^y) = Xi(y)XiM- 

See Tolimieri et al. for details 0. If gcd(p m ,Z) = p m ~^ xi has period p l and the previous 
argument does not work because p m , the size of the additive group, and / are not relatively 
prime. However, by projecting r Ljp mr L onto Z/p-'Z by sending x to x mod pP we transform 
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Xi to a multiplicative character of Z/p*Z with no periodicity. Thus the Fourier transform of 
Xi over Z/p m Z must be 



for some constant K. 



K X i(y/p m -i) Hp m - j \y, 

if p m ~ j \ y, 



B.3 Z/nZ Case 

Given a multiplicative character of Z/nZ, Xh,...,i k the vector with component x equal to 
Xii,...,« fe (a ; ) is equal to the tensor product of the corresponding vectors of the x[]\ • • • ? • 

The Fourier transform of Xh,—,h wm then be the tensor product of the Fourier transforms 
of the Xil\ ■ ■ ■ i Xi^ ■ So if the period of Xh,-,h ls T, the Fourier transform of Xh,-,h ls 



Xh,...Mv) = 

for some constant K. 




,i k (y/T) i£T\y, 
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